A Security Information and Event Management (STEM) system may collect information from monitored applications or network devices in an enterprise environment or other type of information processing system. The SIEM system may use the collected information to build a database of enterprise activity in an STEM database, with the information stored in the STEM database being utilized for performing various analytics relating to the enterprise environment. As enterprise environments increase in size, the management of STEM databases becomes an increasingly costly and complex task.